<disclaimer: I'm no security nor OS programming expert>
When you consider that in the desktop you need a market share of more than 10-15% to be targeted by specific attacks, I'd say yes, there's no way someone would write one just for the N900 (or even for Harmattan).
Maybe you could fall generic attacks (like flash based, because we don't have official java ), that sometimes impact linux as well, but it shouldn't be worse than your average desktop.

But for a targeted attack, reporting ps regularly to a server, and then recording only when something interesting is happening (with DBUS), you should be able to record whatever you need without to much impact (screen recording is a bit more demanding, uses a noticeable part of CPU)